mcpField
J
Jwt Decoder X402

Jwt Decoder X402

Remote
github.comSecurity0Updated 8w ago

About Jwt Decoder X402

Jwt Decoder X402 is an API and MCP server for decoding JWTs without signature verification. It returns token headers, payloads, claims, and expiry details, with HTTP calls paid per request through x402.

Key features

  1. 01Decode JWTs without verification
  2. 02Inspect headers and payloads
  3. 03Check claims and expiry
  4. 04Pay per call via x402

Use cases

  1. 01Debug authentication issues
  2. 02Inspect claims before API calls
  3. 03Check whether a token has expired

MCP support

The MCP server exposes the `security_decode_jwt` tool, which accepts a JWT and returns decoded token details without verifying its signature. It can be added to an MCP client using its remote endpoint.

Configuration

Remote servers need no local install. Pick your client, then copy the config or install in one click.

Endpointhttps://jwt-decoder.api.klymax402.com/mcp
Copy install command
Claude CodeTerminal
Cursor.cursor/mcp.json
VS Code.vscode/mcp.json
Claude Desktopclaude_desktop_config.json
Windsurf~/.codeium/windsurf/mcp_config.json

Run commands in a terminal; paste JSON into the client’s MCP config and restart. Servers that need sign-in will prompt on first connect.

Tools

Details

From the project README

JWT Decoder API

MCP Server x402 License: MIT

Decode and inspect JWT tokens without verification. Extracts header, payload, claims, expiry, and signature algorithm. Pay-per-call via x402 (USDC on Base L2) -- no API key, no signup, no rate-limit wall.

Part of the klymax402 marketplace -- 100 x402 micropayment APIs for AI agents, one wallet, USDC on Base.

Quickstart -- MCP

Add to your MCP client config (Claude Desktop, Cursor, ElizaOS, etc.):

{
  "mcpServers": {
    "jwt-decoder": {
      "url": "https://jwt-decoder.api.klymax402.com/mcp"
    }
  }
}

Quickstart -- HTTP (x402)

curl -X POST "https://jwt-decoder.api.klymax402.com/api/decode" \
  -H "Content-Type: application/json" \
  -d '{"token":"..."}'
# -> 402 Payment Required, with an x402 payment challenge in the response body

Any x402-aware client (@x402/fetch, x402-agent-tools, ATXP) handles the 402 -> sign -> retry cycle automatically.

Tools

ToolMethodPathPriceDescription
security_decode_jwtPOST/api/decode$0.003Decode a JWT token without signature verification
security_decode_jwt

Use this when you need to decode and inspect a JWT token without verifying its signature. Returns the full header, payload, and expiration status.

Parameters

NameTypeRequiredDescription
tokenstringyesThe JWT token to decode (format: header.payload.signature)

Example response:

{"header":{"alg":"RS256","typ":"JWT"},"payload":{"sub":"user123","exp":1720000000},"issuedAt":"2025-01-01T00:00:00Z","expiresAt":"2025-07-03T00:00:00Z","isExpired":false}

When to use: debugging authentication issues, inspecting token claims before API calls, or verifying token expiry. Use this BEFORE making authenticated requests to check if a token needs refreshing.

Not for: hashing data (use crypto_generate_hash), base64 encoding/decoding (use utility_encode_base64), password analysis (use security_check_password).

Example agent prompts

  • "Decode and inspect a JWT token without verifying its signature"

Payment

  • Protocol: x402 -- HTTP-native pay-per-call, no signup, no API key
  • Network: Base L2 (eip155:8453)
  • Asset: USDC
  • Facilitator: Coinbase CDP (primary), PayAI (fallback)
  • Also reachable via ATXP (OAuth-wrapped x402, RFC 9728 protected-resource metadata)

Part of klymax402

100 x402 micropayment APIs for AI agents -- one wallet, USDC on Base, zero signup.

License

MIT

Comments

Markdown supported

New to MCP?

From what the protocol is to installing your first server, these answers cover most first questions.

An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.